2011-01-12 Kenichi Ishibashi <bashi@google.com>
authortkent@chromium.org <tkent@chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 13 Jan 2011 03:48:42 +0000 (03:48 +0000)
committertkent@chromium.org <tkent@chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 13 Jan 2011 03:48:42 +0000 (03:48 +0000)
commitd408e11e7dc97d28ce8819ffa181ca84d02ab594
tree0342bf41455fb217f1050f8036599ab6f179e683
parent994697a7e1a9f0c0a82e9989ace4875ff090a355
2011-01-12  Kenichi Ishibashi  <bashi@google.com>

        Reviewed by Kent Tamura.

        M_formElementsWithFormAttribute not cleared when Node is moved to another document.
        https://bugs.webkit.org/show_bug.cgi?id=51418

        Calls unregisterFormElementWithFormAttribute() when form associated elements
        are moved to another document.

        Test: fast/forms/change-form-element-document-crash.html

        * html/FormAssociatedElement.cpp:
        (WebCore::FormAssociatedElement::willMoveToNewOwnerDocument): Added.
        * html/FormAssociatedElement.h: Added willMoveToNewOwnerDocument().
        * html/HTMLFormControlElement.cpp:
        (WebCore::HTMLFormControlElement::willMoveToNewOwnerDocument): Added.
        * html/HTMLFormControlElement.h: Added willMoveToNewOwnerDocument().
        * html/HTMLObjectElement.cpp:
        (WebCore::HTMLObjectElement::willMoveToNewOwnerDocument): Added.
        * html/HTMLObjectElement.h: Added willMoveToNewOwnerDocument().
        * html/HTMLPlugInImageElement.h: Moves willMoveToNewOwnerDocument() to protected.

2011-01-12  Kenichi Ishibashi  <bashi@google.com>

        Reviewed by Kent Tamura.

        M_formElementsWithFormAttribute not cleared when Node is moved to another document.
        https://bugs.webkit.org/show_bug.cgi?id=51418

        Added test for crash when moving form elements from one document to another.

        * fast/forms/change-form-element-document-crash-expected.txt: Added.
        * fast/forms/change-form-element-document-crash.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@75675 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/fast/forms/change-form-element-document-crash-expected.txt [new file with mode: 0644]
LayoutTests/fast/forms/change-form-element-document-crash.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/html/FormAssociatedElement.cpp
Source/WebCore/html/FormAssociatedElement.h
Source/WebCore/html/HTMLFormControlElement.cpp
Source/WebCore/html/HTMLFormControlElement.h
Source/WebCore/html/HTMLObjectElement.cpp
Source/WebCore/html/HTMLObjectElement.h
Source/WebCore/html/HTMLPlugInImageElement.h